Non-ideal bit commitment and coin tossing


Can someone please explain rigorously the reasoning behing non-ideal ($\epsilon$-concealing and $\delta$-binding) bit commitment scheme and the impossibility of coin tossing.

What is bias in coin tossing? How to use non-ideal bit commitment scheme to come up with non-ideal coin tossing and how to estimate the bias.

Lo-Chau paper "Why quantum bit commitment and ideal coin tossing are impossible" has some of the details, but it looks like it omits a lot of details we could add 22 years later.

And I could not understand Mayers' work "Trouble with quantum bit commitment".

Thank you very much.


Posted 2020-11-01T13:54:02.547

Reputation: 95



The key observation that is used, both to break the bit commitment scheme and the ideal coin tossing scheme, is that by requiring that one of the players has a zero probability of cheating, you require the fidelity between two of the reduced density operators to be zero. The flip side of this means that the two reduced density operators are perfectly distinguishable to the other player. For example, in the bit commitment scheme if we want to prevent Alice from cheating (changing her answer following the commit phase) we allow Bob to distinguish between the two reduced density operators (and so he could learn Alice's committed bit). This observation is used in the "backward induction proof" of the ideal quantum coin tossing is impossible theorem in to ultimately give a contradiction.

Remark that in bit commitment the trade off goes both ways. If we want to prevent Bob from distinguishing between the two reduced density matrices with probability no greater than 1/2, then we end up allowing Alice to cheat because the indistinguishability of the reduced density matrices implies that Alice can change her answer, as the two states are then related by a local isometry (this is Uhlmann's theorem).

The $\epsilon$-concealing and $\delta$-binding parameters in the bit commitment scheme merely interpolate between the two mentioned extremes, ultimately there is a fundamental trade off between the two parameters, which demonstrates that there is no ideal bit commitment scheme.


Posted 2020-11-01T13:54:02.547

Reputation: 664